4 ms·
Yep. SSL is now viewed as a good best practice for data in transit, to the point that Apple was criticized for not enabling it for the App Store (http://news.cn
by declan 13y ago
Yep. SSL is now viewed as a good best practice for data in transit, to the point that Apple was criticized for not enabling it for the App Store (http://news.cnet.com/8301-13579_3-57573334-37/ http://news.cnet.com/8301-13579_3-57573334-37/).
But the real issue, as you indicate, is stored data. Full Gmail encryption would presumably be done in conjunction with the client via the browser. Because the server wouldn't have access to the plaintext, search becomes tricky and contextual ads problematic. One solution would be for Google to make fully encrypted Gmail a paid service.
- duaneb 13y agoGoogle would never add encryption to gmail. As a business decision it's pretty atrocious.
- EthanHeilman 13y agoThey could still do targeted advertising and client side encryption. You just have some of the words hashed and sent to a third party web service that compares hashed words against ad words. With the right level of noise you could preserve both the security of the communications and offer targeted advertising. Or google could offer ad free encrypted gmail that costs money. There are plenty of business solutions to this problem and we will see many of them tried.
- declan 13y agoDon't you mean: "Google would never add encryption for stored messages to unpaid Gmail accounts." Why would it necessarily be an "atrocious" business decision to charge extra for encrypted accounts? Google's happy to charge when the market demand exists for a paid service (GAE and GAB come to mind). It's true that the market demand may be insufficient here to make it worthwhile, but on the other hand privacy-sensitive companies and agencies might be more willing to switch to paid Gmail if their email were seen as more private than it is today.
- superuser2 13y agoIt's also unlikely that Google could do government-proof mail any better than Husmail. They were compelled to fake the Java client in order to obtain a user's keys; why couldn't Google be pressured to do the same?
- sixothree 13y agoCompelled by a warrant? I think that would be acceptable to most people.
- gcr 13y agoTo the kind of people that think encrypted email is important, being "compelled by a warrant" to break the encryption is exactly what they wanted to protect against in the first place.
- superuser2 13y ago> To the kind of people that think encrypted email is important Are you really okay with the police reading your email at any time for any reason? I would understand your attitude if email was already protected and encryption could only serve to hide from search warrants and wiretap orders, but that's not the case. The government can and does read our email whenever it pleases. How are you okay with this?
- jonknee 13y agoWhy not? They already have a popular paid version that doesn't have any advertising. It seems like encryption would be a pretty compelling add-on to lure over businesses that are nervous about their data in the cloud.
- pyre 13y agoSearch is another one of their features. How would search work if all of the data was encrypted? Pushing search to the client doesn't make sense. Only encrypting emails in transit doesn't make sense because that doesn't get around this issue of the government forcing them to turn over information without a warrant.
- duaneb 13y agoBecause the average person's data is probably worth far more than they're willing to pay to encrypt it.